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In the Claims 

1-86. (Cancelled) 

87. (New) In a system comprising at least two software applications, a context manager 
which facilitates a sharing of a context among the at least two software applications in 
accordance with the Clinical Context Object Workgroup (CCOW) standard, a centralized 
database accessible to the context manager, and an auditor which provides an interface to enable 
the extraction of information from the centralized database relating to attempts to access patient 
data by the at least two software applications, a method comprising acts of: 

(A) storing, in the centralized database, information relating to attempts to access 
patient data by the at least two software applications; and 

(B) extracting, by the auditor, at least some of the information stored in the 
centralized database relating to attempts to access patient data by the at least two software 
applications, the at least some of the information being suitable for making an assessment as to 
compliance with at least one provision of the Health Insurance Portability and Accountability 
Act (HIPP A). 

88. (New) The method of claim 87, wherein the act (B) comprises extracting information 
relating to at least one attempt to access patient data that is unauthorized via at least one rule. 

89. (New) The method of claim 88, wherein the at least one rule is specified by the at least 
one provision of HIPAA. 

90. (New) The method of claim 88, wherein when the extracted information indicates that at 
least one unauthorized attempt was made to access patient data, the method further comprises an 
act of: 

(C) creating a report comprising an alert indicating that the unauthorized attempt was 
made to access patient data. 
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91 . (New) The method of claim 87, wherein the patient data includes data relating to at least 
a first patient, and the information extracted from the centralized database in the act (B) 
comprises information relating to attempts to access the data relating to the first patient. 

92. (New) The method of claim 87, wherein the act (A) comprises an act of storing 
information, relating to attempts to access patient data, that is provided by the at least two 
software applications. 

93. (New) A system for auditing attempts to access patient data in a computer system 
comprising at least two software applications operable to access patient data and a context 
manager which facilitates a sharing of a context among the at least two software applications in 
accordance with the Clinical Context Object Workgroup (CCOW) standard, the system 
comprising: 

a centralized database that stores information relating to attempts to access patient data 
by the at least two software applications; and 

an auditor that provides an interface to enable an extraction of at least some of the 
information from the centralized database relating to attempts to access patient data by the at 
least two software applications, the at least some of the information being suitable for making an 
assessment as to compliance with at least one provision of the Health Insurance Portability and 
Accountability Act (HIPPA). 

94. (New) The system of claim 93, further comprising a report facility that creates at least 
one report, based upon the extracted information, which presents information relating to attempts 
to access patient data by the at least two software applications. 

95. (New) The system of claim 94, wherein the system further comprises an alert facility 
which sends an alert to a user when it is determined that an attempt unauthorized by at least one 
HIPAA provision was made to access patient data. 
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96. (New) The system of claim 93 , wherein the auditor interface further enables the 
extraction of at least some of the information from the centralized database relating to attempts 
to access patient data that are unauthorized by the at least one HIPAA provision. 

97. (New) The system of claim 94, wherein the patient data includes data relating to a first 
patient, and the at least one report includes information extracted from the centralized database 
on attempts to access the data relating to the first patient. 

98. (New) The system of claim 93, wherein the information relating to attempts to access 
patient data is provided by the at least two software applications to the centralized database. 

99. (New) At least one computer readable medium encoded with instructions for execution in 
a computer system comprising at least two software applications, a context manager which 
facilitates a sharing of a context among the at least two software applications in accordance with 
the Clinical Context Object Workgroup (CCOW) standard, a centralized database accessible to 
the context manager, and an auditor which provides an interface to enable the extraction of 
information from the centralized database relating to attempts to access patient data by the at 
least two software applications, the instructions, when executed on the computer system, perform 
a method comprising acts of: 

(A) storing, in the centralized database, information relating to attempts to access 
patient data by the at least two software applications; and 

(B) extracting, by the auditor, at least some of the information stored in the 
centralized database relating to attempts to access patient data by the at least two software 
applications, the at least some of the information being suitable for making an assessment as to 
compliance with at least one provision of the Health Insurance Portability and Accountability 
Act (HIPP A). 

100. (New) The at least one computer readable medium of claim 99, wherein the act (B) 
comprises extracting information relating to at least one attempt to access patient data that is 
unauthorized via at least one rule. 
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101 . (New) The at least one computer readable medium of claim 100, wherein the at least one 
rule is specified by the at least one provision of HIPAA. 

102. (New) The at least one computer readable medium of claim 100, wherein when the 
extracted information indicates that at least one unauthorized attempt was made to access patient 
data, the method further comprises an act of: 

(C) creating a report comprising an alert indicating that the unauthorized attempt was 
made to access patient data. 

103. (New) The at least one computer readable medium of claim 99, wherein the patient data 
includes data relating to at least a first patient, and the information extracted from the centralized 
database in the act (B) comprises information relating to attempts to access the data relating to 
the first patient. 

104. (New) The at least one computer readable medium of claim 99, wherein the act (A) 
comprises an act of storing information, relating to attempts to access patient data, that is 
provided by the at least two software applications. 

105. The at least one computer readable medium of claim 99, wherein the centralized database 
provides a single interface to the auditor to enable the extracted data to be extracted via the 
single interface. 

106. (New) In a system comprising at least two software applications capable of accessing 
patient data, a centralized database, and an auditor that is coupled to the centralized database, a 
method comprising acts of: 

(A) storing, in the centralized database, information relating to attempts to access 
patient data by the at least two software applications; and 

(B) extracting, by the auditor, at least some of the information stored in the 
centralized database relating to attempts to access patient data by the at least two software 
applications, the at least some of the information being suitable for making an assessment as to 
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compliance with at least one provision of the Health Insurance Portability and Accountability 
Act (HIPP A). 

107. (New) The method of claim 106, wherein the act (B) comprises extracting information 
relating to at least one attempt to access patient data that is unauthorized via at least one rule. 

108. (New) The method of claim 107, wherein the at least one rule is specified by the at least 
one provision of HIPAA. 

109. (New) The method of claim 107, wherein when the extracted information indicates that at 
least one unauthorized attempt was made to access patient data, the method further comprises an 
act of: 

(C) creating a report comprising an alert indicating that the unauthorized attempt was 
made to access patient data. 

110. (New) The method of claim 106, wherein the patient data includes data relating to at least 
a first patient, and the information extracted from the centralized database in the act (B) 
comprises information relating to attempts to access the data relating to the first patient. 

111. (New) The method of claim 1 06, wherein the act (A) comprises an act of storing 
information, relating to attempts to access patient data, that is provided by the at least two 
software applications. 

1 12. (New) A system for auditing attempts to access patient data in a computer system 
comprising at least two software applications operable to access patient data, the system 
comprising: 

a centralized database that stores information relating to attempts to access patient data 
by the at least two software applications; and 

an auditor that provides an interface to enable an extraction of at least some of the 
information from the centralized database relating to attempts to access patient data by the at 
least two software applications, the at least some of the information being suitable for making an 
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assessment as to compliance with at least one provision of the Health Insurance Portability and 
Accountability Act (HIPP A). 

113. (New) The system of claim 1 12, further comprising a report facility that creates at least 
one report, based upon the extracted information, which presents information relating to attempts 
to access patient data by the at least two software applications. 

1 14. (New) The system of claim 113, wherein the system further comprises an alert facility 
which sends an alert to a user when it is determined that an attempt unauthorized by at least one 
HIPAA provision was made to access patient data. 

115. (New) The system of claim 113, wherein the system further comprises a graphical user 
interface (GUI), and wherein the report is presented to a user via the GUI. 

1 16. (New) The system of claim 1 12, wherein the auditor interface further enables the 
extraction of at least some of the information from the centralized database relating to attempts 
to access patient data that are unauthorized by the at least one HIPAA provision. 

1 1 7. (New) The system of claim 113, wherein the patient data includes data relating to a first 
patient, and the at least one report includes information extracted from the centralized database 
on attempts to access the data relating to the first patient. 

1 1 8. (New) The system of claim 1 12, wherein the information relating to attempts to access 
patient data is provided by the at least two software applications to the centralized database. 

1 19. (New) At least one computer readable medium encoded with instructions for execution in 
a computer system comprising at least two software applications capable of accessing patient 
data, a centralized database, and an auditor that is coupled to the centralized database, the 
instructions, when executed on the computer system, perform a method comprising acts of: 

(A) storing, in the centralized database, information relating to attempts to access 
patient data by the at least two software applications; and 
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(B) extracting, by the auditor, at least some of the information stored in the 
centralized database relating to attempts to access patient data by the at least two software 
applications, the at least some of the information being suitable for making an assessment as to 
compliance with at least one provision of the Health Insurance Portability and Accountability 
Act (HIPP A). 

120. (New) The at least one computer readable medium of claim 119, wherein the act (B) 
comprises extracting information relating to at least one attempt to access patient data that is 
unauthorized via at least one rule. 

121. (New) The at least one computer readable medium of claim 120, wherein the at least one 
rule is specified by the at least one provision of HIPAA. 

122. (New) The at least one computer readable medium of claim 120, wherein when the 
extracted information indicates that at least one unauthorized attempt was made to access patient 
data, the method further comprises an act of: 

(C) creating a report comprising an alert indicating that the unauthorized attempt was 
made to access patient data. 

123. (New) The at least one computer readable medium of claim 1 19, wherein the patient data 
includes data relating to at least a first patient, and the information extracted from the centralized 
database in the act (B) comprises information relating to attempts to access the data relating to 
the first patient. 

124. (New) The at least one computer readable medium of claim 119, wherein the act (A) 
comprises an act of storing information, relating to attempts to access patient data, that is 
provided by the at least two software applications. 

125. The at least one computer readable medium of claim 1 19, wherein the centralized 
database provides a single interface to the auditor to enable the extracted data to be extracted via 
the single interface. 



